lkml.org 
[lkml]   [2021]   [Apr]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 26/38] net: mac802154: Fix general protection fault
    Date
    From: Pavel Skripkin <paskripkin@gmail.com>

    commit 1165affd484889d4986cf3b724318935a0b120d8 upstream.

    syzbot found general protection fault in crypto_destroy_tfm()[1].
    It was caused by wrong clean up loop in llsec_key_alloc().
    If one of the tfm array members is in IS_ERR() range it will
    cause general protection fault in clean up function [1].

    Call Trace:
    crypto_free_aead include/crypto/aead.h:191 [inline] [1]
    llsec_key_alloc net/mac802154/llsec.c:156 [inline]
    mac802154_llsec_key_add+0x9e0/0xcc0 net/mac802154/llsec.c:249
    ieee802154_add_llsec_key+0x56/0x80 net/mac802154/cfg.c:338
    rdev_add_llsec_key net/ieee802154/rdev-ops.h:260 [inline]
    nl802154_add_llsec_key+0x3d3/0x560 net/ieee802154/nl802154.c:1584
    genl_family_rcv_msg_doit+0x228/0x320 net/netlink/genetlink.c:739
    genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]
    genl_rcv_msg+0x328/0x580 net/netlink/genetlink.c:800
    netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2502
    genl_rcv+0x24/0x40 net/netlink/genetlink.c:811
    netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline]
    netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1338
    netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1927
    sock_sendmsg_nosec net/socket.c:654 [inline]
    sock_sendmsg+0xcf/0x120 net/socket.c:674
    ____sys_sendmsg+0x6e8/0x810 net/socket.c:2350
    ___sys_sendmsg+0xf3/0x170 net/socket.c:2404
    __sys_sendmsg+0xe5/0x1b0 net/socket.c:2433
    do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
    entry_SYSCALL_64_after_hwframe+0x44/0xae

    Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
    Reported-by: syzbot+9ec037722d2603a9f52e@syzkaller.appspotmail.com
    Acked-by: Alexander Aring <aahringo@redhat.com>
    Link: https://lore.kernel.org/r/20210304152125.1052825-1-paskripkin@gmail.com
    Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/mac802154/llsec.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/net/mac802154/llsec.c
    +++ b/net/mac802154/llsec.c
    @@ -158,7 +158,7 @@ err_tfm0:
    crypto_free_blkcipher(key->tfm0);
    err_tfm:
    for (i = 0; i < ARRAY_SIZE(key->tfm); i++)
    - if (key->tfm[i])
    + if (!IS_ERR_OR_NULL(key->tfm[i]))
    crypto_free_aead(key->tfm[i]);

    kzfree(key);

    \
     
     \ /
      Last update: 2021-04-15 17:09    [W:4.005 / U:0.112 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site